AMENDMENTS TO THE CLAIMS 



1 . (Currently amended) A method for detection of server-like devices within 
a network, said detection method comprising the steps of 

determining a respective the-ingress to egress network traffic ratio for at least 
some of the devices, 

and selecting the server-like devices on the basis of each said-determined ratio 
ratios or a figure derived from each said-determined ratio, ratios, 

2. (Currently amended) A method as claimed in claim 1 in which each 
server-like device is connected to a port of another device and the ingress to egress 
network traffic ratio is determined by determining the-network traffic through said port. 

3. (Original) A method as claimed in claim 2 in which said network 
traffic through said port is determined using SNMP. 

4. (Original) A method as claimed in claim 1 in which the step of 
selecting the server-like devices includes selecting those devices having a value of said 
determined ratio above a selected value. 

5. (Original) A method as claimed in claim 4 including the step of 
ranking the devices in order of their determined ratios. 
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6. (Original) A method as claimed in claim 5 in which the selection of 
the server-like devices includes determining discontinuities in the values of the 
determined ratios of the ranked devices. 

7. (Currently amended) A method as claimed in claim 5 including the step 
of nominally plotting the determined ratios of the devices against the ranked devices and 
deriving a the-second derivative of a resulting ordered ratio tha-graph, and using the 
second derivative to select the server-like devices, 

8. (Currently amended) A method as claimed in claim 6 including the step 
of nominally plotting the determined ratios of the devices against the ranked devices and 
deriving a the-third derivative of a resulting ordered ratio the-graph, and using fee-second 
and third derivatives to select the server-like devices. 

9. (Original) A method as claimed in claim 8 including the step of using 
the second and third derivatives to divide the devices into groups and selecting one or 
more of the groups of devices as server-like devices. 

10. (Currently amended) A method as claimed in claim 9 in which devices 
are divided into groups by determining the-boundaries of the groups as points where the 
second derivative is zero and the third derivative is less than zero. 
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11. (Original) A method as claimed in claim 10 in which the step of 
selecting one or more of the groups of devices as server-like devices comprises selecting 
one of said points as a cut-off point beyond which all devices are considered as exhibiting 
server-like behaviour. 

12. (Currently amended) A computer program on a computer readable 
medium loadable into a digital compute r or embodi e d in a carri e r wav e, said computer 
program comprising software for performing the steps of claim 1. 

13. (Currently amended) A computer program on a computer readable 
medium loadable into a digital computer, or embodi e d in a carrier wave, said computer 
program comprising the following stepsi[[;]] 

program step 100:[[;]] Start 

program step 10U[[;]] for counter value iflnOctet, a total number of Octets 
received on a given interface of a managed network device, and counter value ifOutOctet, 
a total number of Octets transmitted from a given interface of a managed network device; 
Retrieve iftaOctets and iPOutOctets counter values from all devices by interrogating the 
agents of managed devices and determining traffic data from ports connected to those 
devices; 

program step 102:[[;]] Is this a tfee-first iteration? If no, go to program step 103l[[. 
If]] if yes, go to program step 104;[[.]] 
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program step 103 :[[;]] Use stored iflnOctets and ifOutOctets values from previous 
iterations to calculate iflnOctets and ifOutOctets delta values for this sample period and 
store these in memory; [[. 11 

program step 104:[[;]1 Store in memory current iflnOctets and ifOutOctets values 
for all devices;[[.11 

program step 105:[[;]1 Are there more sampling periods? If yes, return to program 
step 101;[[. If]] i£no, go to program step 106;[[.]] 

program step 106:[[;]] Calculate mean iflnOctets and ifOutOctets values for each 
device, averaging across all sampling periods and store in memory; [[. 11 

program step 107:[[;]] Sort results into ascending order and calculate 2^^ and 3'^ 
derivative values;[[.]] 

program step 108 :[[;]] Store all points where second derivative is zero and third 
derivative is less than zero;[[.]] 

program step 109i[[;]] Were any points found? If no, go to program step 110;[[. 
If]] if yes, go to program step 1 1 U[[.]] 

program step 110i[[;]] Use a sensitivity setting to determine which devices to 
regard as exhibiting server- like behaviour and go to program step 1 12;[[.]] 

program step llli[[;]] Use a sensitivity setting to determine which of the found 
points to use as a cut-off point, regard all devices in the ordered ratio graph beyond this 
point as exhibiting server-like behaviour , and go to program step 1 12;[[.]] 

program step 112i[[;]] End. 
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14. (Currently amended) Network apparatus for detection of server-like 
devices within a network, said apparatus comprising means for determining a respective 
the-ingress to egress network traffic ratio for at least some of the devices, and means for 
selecting the server-like devices on the basis of each said-determined ratio ratios or a 
figure derived from each said-determined ratio, ratios, 

' 15. (Currently amended) Apparatus as claimed in claim 14 in which each 
server-like device is connected to a port of another device and the ingress to egress 
network traffic ratio is determined by determining the-network traffic through said port. 

16. (Original) Apparatus as claimed in claim 15 in which said network 
traffic through said port is determined using SNMP. 

17. (Original) Apparatus as claimed in claim 14 including means for 
selecting those devices having a value of said determined ratio above a selected value. 

18. (Currently amended) Apparatus as claimed in claim 17 including means 
for ranking the devices in order of their determined ratios. 

19. (Original) Apparatus as claimed in claim 18 including means for 
determining discontinuities in the values of the determined ratios of the ranked devices. 
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20. (Currently amended) Apparatus as claimed in claim 18 including means 
for nominally plotting the determined ratios of the devices against the ranked devices and 
deriving a^tha-second derivative of a resulting ordered ratio tbe-graph, and means for 
using the second derivative to select the server-Hke devices. 

21. (Currently amended) Apparatus as claimed in claim 19 including means 
for nominally plotting the determined ratios of the devices against the ranked devices 
and deriving a.fee-third derivative of a resulting ordered ratio the-graph, and means for 
using the-second and third derivatives to select the server-like devices. 

22. (Currently amended) Apparatus as claimed in claim 21 including means 
for using the-second and third derivatives to divide the devices into groups and selecting 
one or more of the groups of devices as server-like devices. 

23. (Currently amended) Apparatus as claimed in claim 22 including means 
for dividing the devices into groups by determining the-boundaries of the groups as points 
where the second derivative is zero and the third derivative is less than zero. 

24. (Original) Apparatus as claimed in claim 23 including means for 
selecting one or more of the groups of devices as server-like devices by selecting one of 
said points as a cut-off point beyond which all devices are considered as exhibiting 
server-like behaviour. 
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